{"id":"CVE-2026-114268","published":"2026-10-21T19:17:00.780","lastModified":"2026-10-22T15:15:23.833","description":"A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet. This manipulation of the argument security_5g causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-119","CWE-120"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Tmzop/Tenda-CVE","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-114268","tags":[]},{"url":"https://vuldb.com/submit/1018994","tags":[]},{"url":"https://vuldb.com/vuln/424700","tags":[]},{"url":"https://vuldb.com/vuln/424700/cti","tags":[]},{"url":"https://www.tenda.com.cn/","tags":[]}],"exploitRefs":[{"url":"https://github.com/Tmzop/Tenda-CVE","tags":[]}],"hasPoc":true,"ai":{"summary":"A buffer overflow in the /goform/WifiBasicSet endpoint of Tenda BE3L Pro firmware v16.03.60.62 allows remote attackers to overwrite memory via the security_5g parameter, potentially enabling code execution or denial of service.","exploitability":"Exploitation requires low privileges (authenticated user) and no user interaction; the exploit is publicly available.","blast_radius":"Successful exploitation could lead to full system compromise (remote code execution), data exfiltration, or device unavailability, affecting all connected network users.","remediation":"Upgrade to firmware version 16.03.60.63 or later, as the vendor has not yet released a fixed version for this specific vulnerability in the published description.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["buffer-overflow","authenticated","firmware","wifi","rce"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:49:42.054Z"}}